There’s a moment in certain first meetings we’ve learned to listen for. The owner has walked us through everything: the server closet doing its best, the shared login somebody set up “just for now” years ago, the one employee who handles the computers on top of her actual job. Patient the whole way through our questions. Then, usually near the end, it finally comes out. “I don’t like all this. Isn’t there more we should do?”
If you’ve ever said some version of that sentence to an IT person, or started to and got reassurance instead of an answer, this page was written for you.
What asking sounds like
It almost never sounds technical. The people who ask usually can’t name their firewall model, and they shouldn’t have to. They just know, before they have words for it, that the office now runs on things nobody is really watching. An insurance renewal can put it there, with a questionnaire noticeably longer than last year’s. So can their biggest client’s new security addendum, or a colleague’s very bad week two towns over. And some owners need no push at all. They’ve never liked not knowing.
The question is all the qualification we need. The person asking it is already looking for a different kind of provider, whether or not anyone has told them that yet.
The ones we couldn’t help
We can tell you exactly why the askers are our people, because we learned it the slow way: good IT work only moves when the owner wants to move with it. For years we tried to supply the wanting ourselves.
There was an office where the password was taped to the monitor the day we first walked in and taped there still after we’d asked about it in person and by phone and finally in writing, because we kept believing the next ask would be the one that landed. And there was the office that could recite what its own regulations required, chapter and verse, better than most consultants we’ve met, and had priced the work of meeting them and decided, eyes open, not to.
It would be easy to be funny about the taped password. We’re not going to be. Running a small business is triage all the way down. Every owner is choosing which risks to carry every single day, and the one who decides security loses to payroll this quarter has done arithmetic that was hers to do, weighing risks we never had to carry. Our job was to lay out the tradeoffs in plain English and say what we’d do in her chair; the deciding was never our part. It took us years to accept that, because walking away from a person whose bad day you can picture does not come naturally. So we didn’t walk. We kept asking. And somewhere past the third ask we were just nagging, and attaching an invoice to the nagging.
There’s a page on this site that says we don’t sign everyone. This is where that page comes from. We stopped pushing. The stopping felt like relief, which told us how badly we’d overstayed.
What we mean by help
The people who ask deserve something better than a scare pitch, and most of them can smell one anyway. So here’s the line we use in first meetings, said with a straight face: every system has a part between the seat and the keyboard. People nod. A half second later they hear it, their eyes get a little bigger, and everybody gets to smile. That part is a person. The person gets tired, works late, comes back from lunch to forty unread emails. They’re who we design for.
The honest test is the busiest person’s worst Tuesday. The bookkeeper in the second week of March, the paralegal covering a colleague’s desk, the new hire who started Monday and badly wants to be helpful. Build for them. Assume that someday one of them, rushed and tired, clicks the thing they shouldn’t, and set the gates so that it doesn’t matter. If the click happens and the gates hold, the training worked, the design worked, and what’s left is the conversation afterward: help the person who clicked without making them feel foolish. They already do.
You can lock down every account and rehearse every backup and still fail that test if the training only lands on people having a calm week. Training that works is built for the worst Tuesday too: short, specific to how offices like yours get attacked, timed to the moments it matters instead of once a year in a conference room. Design it that way and you stop needing your people to be perfect. Which is good, because nobody’s are.
What to hold out for, from anyone
You may read all of this and never call us. Plenty of good shops exist. Wherever you land, a few questions are worth the awkwardness of asking out loud.
Do they ask you anything back? Watch what happens to your first real question. If the answer arrives in three seconds (“yeah, that should be fine”), it arrived before anyone understood what you were asking, and you’ve learned the main thing already. Some of the worst weeks we’ve been called in to clean up started exactly there: a fast yes from somebody already reading the next ticket. The good version is slower, and it asks you things you didn’t think were related. Let it.
What will you be able to see? Ask it exactly that way. Before the work: a plan for your office in words you understand, and a number you approved. After: evidence. The backup that was actually restored as a drill, with a date on it. The report that shows up whether or not anything went wrong that month. Ask for these while you’re still deciding, when you have their full attention.
Who have they turned down lately? It feels rude to put that to somebody hoping to sign you. Ask anyway, and watch what the question does to the conversation. We’ve already told you ours.
We’re a small company in Bristol, and we choose carefully where our time goes. We spend it on the owners who want the help. If that’s you, come ask the question in your own words.
Tell us what cannot fail, and we’ll start there.